Updated October 21, 2026: The PHP development team has released emergency security patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS v4.0 severity score of 9.2.

PHP has confirmed that these vulnerabilities can allow unauthenticated remote code execution (RCE). That means an attacker could potentially execute malicious code on an affected server without needing an account or login credentials.

The vulnerabilities are not specific to WordPress. They affect the underlying PHP runtime, potentially exposing WordPress and other PHP-powered websites and applications.

If you manage a WordPress website, check whether your server has received the patched PHP release. If you use shared or managed hosting, your provider may handle the update automatically. VPS and dedicated server administrators should update their PHP packages directly.

Which PHP Versions Are Patched?

The PHP team released the following security updates on October 21, 2026:

PHP branchPatched version
PHP 8.58.5.12
PHP 8.48.4.27
PHP 8.38.3.36
PHP 8.28.2.35

If your server runs an earlier release in one of these PHP branches, install the appropriate update as soon as possible.

PHP 8.1 and older are no longer supported by the PHP project. Some hosting vendors and Linux distributions provide security backports for older versions, but you should confirm that these specific vulnerabilities are covered rather than assuming your installation is protected.

See the official PHP security announcement for the release details.

How to Update PHP for WordPress

1. Check your website’s PHP version

Open your WordPress dashboard and go to Tools → Site Health → Info → Server. You’ll find the PHP version currently used by your website.

Compare it with the patched versions listed above. If your version is older, you’ll need the corresponding security update or a verified vendor-provided patch.

Keep in mind that some hosting providers backport security fixes without changing the displayed PHP version number. If your host uses this approach, ask them to confirm that both CVEs have been patched.

2. Using shared or managed hosting?

Most shared and managed WordPress hosting providers maintain PHP for their customers, including security updates.

You may not need to install anything yourself. However, some providers apply updates on their own schedule, while others require you to select a newer PHP release in the hosting control panel.

If you’re unsure, ask your provider whether your website’s PHP installation has received the fixes for CVE-2026-109618 and CVE-2026-109619.

Don’t switch to a different PHP branch just to apply a security patch if your current supported branch already has a fixed release available.

3. Managing your own VPS or dedicated server?

If you administer the server yourself, you’ll generally need to update the PHP packages through your hosting control panel or operating system’s package manager.

Before updating, take a server snapshot or backup, particularly if you’re running several production websites. Updating within the same PHP branch is usually less disruptive than moving to a new branch, but you should still verify that your sites work afterward.

Applying PHP Security Patches in WHM/cPanel

If your server uses cPanel/WHM with EasyApache 4, PHP security updates are normally delivered through the configured package repositories.

To update through WHM:

  1. Log in to WHM with root privileges.
  2. Go to Software → System Update. You can also open Software → EasyApache 4 and select Run System Update.
  3. Run the available package updates, following the prompts.
  4. Once completed, verify that your installed PHP packages include the security fixes.

A routine PHP security update does not require rebuilding EasyApache or changing PHP branches. For example, a website already running PHP 8.4 should receive the updated PHP 8.4 packages when its provider makes them available.

Prefer SSH? On AlmaLinux, Rocky Linux, or CloudLinux servers using EasyApache PHP, you can check for updates and install the available packages with:

dnf check-update 'ea-php*'
dnf upgrade 'ea-php*'

On older YUM-based systems, use:

yum update 'ea-php*'

These commands update the installed EasyApache PHP packages. Review the proposed changes before proceeding.

CloudLinux users: Websites using CloudLinux PHP Selector may run Alt-PHP instead of EasyApache PHP. To update the Alt-PHP package group, CloudLinux documents:

yum groupupdate alt-php

Make sure you’re updating the PHP implementation your websites actually use. Updating EasyApache PHP alone won’t necessarily patch sites running Alt-PHP.

For more information, see the cPanel PHP documentation and CloudLinux PHP Selector documentation.

Updating PHP on a Linux VPS Without WHM

If you manage PHP directly on a Linux server, install the security updates from the repository that provides your PHP packages.

Ubuntu or Debian:

sudo apt update
sudo apt list --upgradable
sudo apt upgrade

AlmaLinux or Rocky Linux:

sudo dnf check-update
sudo dnf upgrade

These commands can update packages beyond PHP, so review the transaction before confirming it. If you use a third-party PHP repository, make sure it has published the patched packages.

After updating, restart the affected PHP services if they haven’t restarted automatically, then verify that your websites are using the updated PHP installation.

For PHP-FPM environments, existing worker processes must be restarted to load the patched binaries. Check the service name and PHP version used by your server before restarting anything.

If you host multiple PHP versions, check each installation separately. Running php -v over SSH may show the command-line PHP version rather than the one handling website requests.

How to Confirm the PHP Patch Is Installed

After the update, check the PHP version again in WordPress → Tools → Site Health → Info → Server and compare it with the fixed releases listed earlier.

For servers using vendor backports, the version alone may not prove whether the fix is installed. Check the package changelog or vendor security advisory for both CVE identifiers.

Also open your website and check that important functions such as login, forms, checkout, and any custom PHP integrations still work.

What if WHM or your package manager shows no updates? That doesn’t automatically mean you’re protected. Your package vendor may not have released the update yet, or your server may be using an unsupported repository or PHP installation. Check the vendor’s security notices before assuming the issue is resolved.

Still Running an Unsupported PHP Version?

If your website runs PHP 7.x, 8.0, or 8.1, it’s a good time to plan an upgrade rather than relying indefinitely on backported security fixes.

PHP 8.4 and 8.5 are sensible upgrade targets for compatible WordPress websites. Check your themes, plugins, and custom code before switching, especially if you’re moving from a much older PHP version.

PHP 8.2 and 8.3 also have fixes available for these vulnerabilities. However, PHP 8.2 reaches the end of official security support on December 31, 2026, so it’s not an ideal long-term upgrade target.

You can check the official PHP support schedule.

What Do These Vulnerabilities Allow Attackers to Do?

PHP has confirmed two separate flaws involving memory handling and internal request state:

  • CVE-2026-109618: A memory allocation failure can leave internal request data in an invalid state. Subsequent cleanup may use that corrupted data, creating a remote code execution risk.
  • CVE-2026-109619: Internal data from an earlier request can remain accessible after its memory has been freed, potentially allowing a later request to exploit the stale state.

The PHP team warns that the vulnerabilities affect PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, LiteSpeed, and FrankenPHP environments.

The risk is considered particularly serious for Apache mod_php, where researchers have demonstrated exploitation before application code begins running.

That distinction matters. A vulnerability in the PHP runtime can affect WordPress, Drupal, Magento, Laravel-based applications, and other PHP websites even when their application software is fully updated.

Updating WordPress core, themes, or security plugins cannot replace patching the vulnerable PHP runtime.

PHP Security Update Status

The official fixes for CVE-2026-109618 and CVE-2026-109619 were released on October 21, 2026.

The PHP team has also documented temporary measures that may reduce exposure to certain exploitation methods. However, these do not provide complete protection. Installing the security update remains the recommended action.

If you use managed hosting, confirm that your provider has applied the fixes. If you manage your own server, update the PHP packages and verify that the running services are patched.

For the complete technical details and any further guidance, refer to the official PHP security advisory.